Sunturai
Back to results
MediumSplunk security contentRaven Tait +1

Windows Potato Privilege Escalation Tool Execution

Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path. A tool class that has been a dominant post-compromise privilege escalation method for…

Description

Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path. A tool class that has been a dominant post-compromise privilege escalation method for over a decade and remains actively used by ransomware operators, red teams, and nation-state actors alike. The Potato family exploits Windows token impersonation and privilege abuse to escalate from a service account, IIS worker process, or other restricted context to SYSTEM. The core abuse chain across most variants involves tricking a SYSTEM-level process into authenticating to an attacker-controlled endpoint, capturing that authentication, and impersonating the resulting SYSTEM token to spawn an elevated process.

Detection logic

Detection requirements

Platform
ContainersLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Some legitimate security tools or authorized pentesting software may use potato privilege escalation methods for testing purposes. Filter alerts based on approved security testing activities.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice